- From: Zoltan Kis via GitHub <sysbot+gh@w3.org>
- Date: Thu, 29 Aug 2019 11:58:35 +0000
- To: public-web-nfc@w3.org
NFC Forum or MiFare classic are underlying tech: but we defined Web NFC specific content over these to be the default, for security reasons. We did have the early assumption that Web NFC comms where origin policies can be applied could be exempt from prompting. However, we realized that same-origin policy cannot be securely _enforced_ with NFC, so the obtaining permission would likely to be the same, regardless of the underlying tech. But if there is legit justification for using the Web NFC content format (external record etc), IMHO it would make sense if that would be the default and I'd like developers to explicitly and consciously having to express their choice by specifying "any" or "vendor" if "web-nfc" is not enough. -- GitHub Notification of comment by zolkis Please view or discuss this issue at https://github.com/w3c/web-nfc/pull/299#issuecomment-526153126 using your GitHub account
Received on Thursday, 29 August 2019 11:58:37 UTC